Analysis of employee diligence and mining of behavioral patterns based on portrait portrayal

With the deepening of enterprise digital construction, the portrait portrayal based on employee behaviors has gradually become a research focus. Currently, the employee's portrait portrayal mostly has the problems of simple means, low efficiency, limited solving ability, etc., making the results more one-sided. Therefore, a data mining-based employee portrait portrayal model is proposed. The content of employee portrait portrayal is deeply analyzed, and the overall framework of the model is designed. A diligence analysis model (DAM) based on improved GAN is constructed, and the diligence evaluation of employees is clarified to realize the diligence evaluation. The results of diligence analysis of DAM have high accuracy (80.39%) and outperform SA (70.24%), K-means (51.79%) and GAN (67.25%). The Kappa coefficient of DAM reaches 0.7384, which is highly consistent and higher than SA (0.6075), K-means (0.3711) and GAN (0.5661). The Local Outlier Factor (LOF) and Isolation Forest (IF) are used to detect abnormal behaviors on the employees, and mine the abnormal behavior patterns on different granularity time. The LSTM model (Att-LSTM) based on the attention mechanism is used to complete the prediction of employees' software usage behaviors, and analyze and summarize the characteristics of employee's behaviors from multiple perspectives. Att-LSTM predicts the best with an RMSE of 0.82983, which is better than LSTM (0.90833) and SA (0.97767); AM-LSTM has a MAPE of 0.80323, which is better than LSTM (0.86233) and SA (0.92223). The results show that the data mining-based employee portrait portrayal method can better solve the problem of enterprise employees' digital construction, and provide a new way of thinking for the construction of enterprise-level employees' digital portrait model and the analysis of employee behavior.

Therefore, to address the above problems, this paper takes the employees of a new energy automobile enterprise as the research target, and carries out the research on the employee portrait portrayal method based on data mining, focusing on the analysis of employee diligence, identification of abnormal behavior and mining of temporal behavioral patterns.The contents, standards and dimensions of employee portraits are clarified, and the general framework of employee portraits and behavioral analysis is designed.Based on data mining, combined with statistical analysis and deep learning, the Generating Adversarial Networks (GAN) model is improved to evaluate employee diligence.Isolation Forest (IF) combined with Random Forests (RF) and Local Outlier Factor (LOF) are used to analyze the abnormal behavioral characteristics of employees at different times, and to discover temporal behavioral patterns.The Long Short-Term Memory (LSTM) model based on attention mechanism was further used to predict the employee behavior and verify the model effect.
This study is based on solving the practical problems of employee portrait characterization and behavioral analysis, combining the behavioral analysis theory with data mining and deep learning to meet the rigid needs of enterprises' big data work on employees, and achieve the purpose of employee portrait characterization and behavioral analysis.This study proves the feasibility of the theoretical method, and the proposed employee portrait portrayal method and behavioral analysis method improves the accuracy of employee portrait portrayal, fully exploits the potential value of multi-source heterogeneous data, and provides theoretical basis and practical significance in the promotion of the enterprise big data construction and the behavioral analysis oriented to multi-source heterogeneous data.

Content and standards of portrait characterization
Portrait portrayal content Employee diligence has certain representation in employee portrait portrayal [9][10][11] , including job classification, work rigor, management ability, design ability and other representation, so it is necessary to use behavioral characteristics to realize employee diligence analysis.Behavioral information reflects the dynamic attributes of employees, so according to the employee behavior to mine behavioral laws and realize their behavioral prediction.
The set of employees of an enterprise is denoted as Person = p 1 , p 2 , p 3 . . . .An employee generates n kinds of behavioral data in the enterprise activities, and the i-th kind of behavioral data of employee P is denoted by A p i .Then the set of all behavioral data of P can be denoted as: Behavioral evaluation standards Diligence.Enterprises evaluate whether an employee is diligent and how diligent he is, mainly examining his usual work attitude, conscientiousness, learning ability and planning ability.Therefore, the evaluation of diligence is mainly considered from three aspects: learning (diligent in learning), planning (diligent in planning) and working (diligent in working) 12 .
Diligent in learning: Mainly refers to the ability of employees to learn frequently to improve their ability and work efficiency, usually manifested in book browsing, website browsing, and the use of professional software.Studious employees have a higher frequency of book browsing, longer browsing time, and longer time and frequency of use of professional software.
Diligent in planning: To examine whether they plan in advance, and whether they are capable of executing the plan and the degree of execution, usually manifested in the usual planning, such as the number of planning, the finish rate of planning, the timeliness of planning, and so on.Diligent employees generally have strong planning skills and are able to make reasonable plans and complete them in a timely manner.
Diligence in work: To examine whether the working time of the employees is reasonable, how efficient they are, and how the quality of the tasks is accomplished, usually manifested in attendance, task completion, website www.nature.com/scientificreports/browsing, use of professional software, use of public storage, and so on.In general, relatively hard-working employees have higher attendance, on-time, overtime, frequency of professional website browsing and use.
For "diligent in learning": Book browsing time is book_t, browsing frequency is book_f; browsing time of learning website is web_s_t, browsing frequency is web_s_f; browsing time of work website is web_w_t and browsing frequency is web_w_f; time in using software is software_t and frequency is software_f.Assuming that each factor has its corresponding importance indicator w s i , the "diligent in learning" can be expressed as follows: For "diligent in planning" The number of planning is planning_n, the finish rate of planning is planning_f, and the timeliness of planning is planning_t.Assuming that each factor has its own corresponding importance indicator w p i , the "diligent in planning" can be expressed as follows: For "diligent in working" Attendance frequency is attendance_f, on-time frequency is on Time_f, and overtime frequency is overtime_f; browsing frequency of professional network is professional_network_f, the usage frequency of professional network is professional_software_f 13,14 .Assuming that each factor has its corresponding importance indicator w w i , the "diligent in working" can be expressed as follows: The employee's diligence score Score can eventually be expressed as: Assuming that the scoring quasi-line is and Q 6 , then the diligence level can be divided as: Behavior.Detection of abnormal behaviors: According to the feature weights, N behavioral features are selected and the Local Outlier Factor (LOF) algorithm is applied to calculate their different detection thresholds E for different functions.If an employee's behavior_ Action P exceeds the detection threshold E, it is regarded as abnormal behavior: Employees whose number of abnormal behaviors exceeds a certain threshold are considered as abnormal employees, and the set of abnormal behaviors of employee P is denoted as: If the number of abnormal behaviors n > k, the employees are determined to be abnormal employees.The screened employees with a large number of abnormal behaviors are mined from the perspective of time at different granularities 15 .Adopting the Isolation Forest (IF), the abnormal values on each time period is calculated, and the time period exceeding the abnormal threshold is regarded as abnormal time, so as to determine the time when the abnormal behavior occurs.
Prediction of temporal behaviors: The Long Short-Term Memory (LSTM) model based on attention mechanism is used to analyze the temporal correlation of the historical behavior of software usage and make predictions for new behaviors 16 .Assuming that the real behavior of an employee in a certain time period is base_ action' and the prediction of the behavior is prediction_action i using the prediction model F i , the model can be expressed as: where history_action denotes historical behavioral data; f denotes evaluation metrics; E i denotes the evaluation result of model F i ; ε is a threshold line for evaluating the model.The model needs to satisfy the evaluation result E i does not exceed the threshold line, i.e.E i ≤ ε.

Process of portrait characterization
Combined with the actual workflow of a new energy automobile enterprise, the design of the employee portrait portrayal process is shown in Fig. 1.The process of employee portrait portrayal mainly includes five parts: portrait portrayal content and standard, data processing and feature extraction, diligence analysis, abnormal behavioral analysis, and temporal behavioral prediction.The pre-preparation stage includes the content and standards of employee portrait portrayal and data processing.Diligence evaluation and behavioral mining are the two parallel dimensions of portrait carving, in which the temporal behavioral law includes two parts: abnormal behavioral detection and temporal behavioral prediction.

Diligence criteria
Enterprises evaluate whether employees are diligent or not usually based on the diligence evaluation index to assess employees.Therefore, this paper adopts classical Statistical Analysis (SA), Random Forest (RF), Isolation Forest (IF) and Analytic Hierarchy Process (AHP) with human subjective evaluation factors to comprehensively evaluate the employee diligence and formulate the diligence criteria.

Diligence evaluation index
Diligence evaluation index refers to the evaluation dimensions of employee diligence, i.e., from which angles should employee diligence be evaluated (on-time frequency, overtime frequency, etc.) 17 .Using employee behavior data to evaluate the diligence Q P of employee P, there are k indicators to form the evaluation system of the employee, i.e., to evaluate the employee diligence from k dimensions, then the indicator set Tar is expressed as: where T j denotes the j-th indicator in the indicator set Tar, which contains behavioral data as A j = a j 1 , a j 2 , a j 3 , . . . .Therefore, it can be set that the behavioral data is the set of data contained in k indicators: Doing feature extraction on the employee behavior data _Action, the feature vector with m features can be denoted as A = a 1 a 2 . . .a m T , and a i (1 ≤ i ≤ m) denotes the i-th behavioral feature.N sets of time intervals spanning t are formed into a time series A = t 1 t 2 . . .a n to construct a matrix of behavioral characteristics with time series:  18 .Drawing on the RF, the introduction of weights w to make the results of diligence calculation more accurate and reasonable as much as possible.
Sampling with put-back from the sample produces the training set D t , training is performed to produce G t , and multiple G t are combined to get the final processing model G. Theoretically, there will be a portion of the samples that are not selected to train the model G (number 1/e), enough to perform the validation of the model.Out-of-bag samples are utilized for model evaluation and tuning: The importance of various behavioral features is calculated using RF: E oob (G) denotes the error calculated using out-of-bag samples, and E P oob (G) denotes the superposition of a feature from one of the out-of-bag samples with random noise.
The importance of each feature is calculated one by one in this way.The dataset containing N samples is defined as D N = {x 1 , x 2 , . . ., x N } .The application of RF allows to obtain the evaluated value of each feature to be used as the weight w of the feature value.

Indicator calculation
After feature extraction and weights calculation, the behavioral data need to be normalized in order to eliminate the influence of the data magnitude.Minimum-maximum normalization algorithm (Min-Max) is used to do the normalization of the data: where X represents the feature data that need to be normalized, X normalize represents the value of X after normalization, and X min and X max are the minimum and maximum values of the feature data, respectively 19,20 .
Due to the large number of forms of behavioral data, the formula is modified to facilitate the calculation: where a and b represent the range of normalizing the data to [a, b].
After data normalization, the joint matrix of weights and eigenvalues needs to be constructed, then the diligence eigenmatrix can be expressed as: For employee P, further feature extraction is done using RMS Amplitude, and diligence at time period T is: where, q t denotes the t-th diligence value, t ∈ T , Q_R denotes the final diligence result and m denotes the number of behavioral features.

Diligence classification
For the result of diligence calculation Q_R, the set Q = {Q i |1 ≤ i ≤ 6} is defined to delineate the five grade intervals of diligence, all participants are sorted according to the diligence value from the largest to the smallest: where x i is the position, x i ∈ {20%, 40%, 60%, 80%} , 1 ≤ i ≤ 5 , i is an integer; m is the total number of partici- pants; ⌊x i ⌋ on behalf of x i downward rounding, ⌈x i ⌉ on behalf of x i upward rounding, x i %1 on behalf of x i to 1 to take the remainder; F(x) that take the diligence value of the employee at position x.
Combined with the actual cognition of enterprise employees, diligence can be divided into "Diligent", "Ordinary", "Slack".
Scientific Reports | (2024) 14:11942 | https://doi.org/10.1038/s41598-024-62239-0www.nature.com/scientificreports/"Diligent" refers to employees who are active in work, and is subdivided into "Extremely Diligent" and "General Diligent"."Ordinary" employees are ordinary in work, and the evaluation index tends to be the average value."Slack" refers to employees with poor performance in work, subdivided into "Slack" and "Extremely Slack".Therefore, the classification of diligence is expressed as follows:

Data processing
To ensure that the evaluation of diligence has a certain objectivity and basis, it must be combined with on-site research, i.e. human evaluation.Therefore, it is necessary to use AHP analysis: constructing judgment matrix, hierarchical sorting and consistency test, weight matrix construction, and score calculation.

Judgment matrix
The influencing factors are defined, such as attendance frequency, on-time frequency, etc.; two by two comparison of the influencing factors, to determine the proportion of each influencing factor; according to the proportion of the construction of the judgment matrix.With n influence factors of diligence, denoted as F = f i |1 ≤ i ≤ n , the judgment matrix is obtained by two-by-two comparison between influence factors, where J lm denotes the result of comparison between f l and f m : Hierarchical sorting and consistency test Hierarchical sorting of the judgment matrix and calculation of the weight coefficients using the ensemble product method; consistency test is done to eliminate contradictory values in the judgment matrix.The judgment matrix is normalized by columns: After the normalization, the row vectors of the judgment matrix are derived:

Normalized processing vectors:
Constructing the weight matrix and calculating the diligence score During the research process, the indicators of employee diligence are scored according to the scale 1-10, and the weight vector w l is obtained to construct the weight matrix.The final diligence score of Employee P is equal to the cumulative sum of the product of its scores and weights, as shown in the following equation.S p is the final diligence score of employee P, P l is the l-th index score of employee P, and w l is the l-th weight.

Diligence classification
According to "3.1.4",the data normalization range is set to [0, 100], and the final result of diligence is normalized to facilitate the score comparison.By assigning scores, Q 1 = 0, Q 2 = 66.9, Q 3 = 72.3,Q 4 = 80.6, Q 5 = 83.5, and Q 6 = 100 were obtained.Employees' scores in different intervals corresponded to different types of diligence.After feature normalization, training labels are made according to the score of employee diligence, as shown in Table 1:

Model design
Drawing on the traditional GAN, CGAN and DCGAN structures and incorporating the Variational Auto-Encoder (VAE), a Diligence Analysis model (DAM) is proposed.A hidden variable z is constructed such that it satisfies the distribution from z to the target data x' , i.e., x ′ = g(z) , so that the target data x' is as close as possible to the distribution of the real data x.For K samples, the Gaussian distribution for each sample is assumed to be N µ k , σ 2 k .The VAE makes each Gaussian distribution converge to the standard Gaussian distribution N(0,1) as much as possible, as shown in Fig. 2.
The KL scatter is used to calculate the loss.Assume that z obeys a standard Gaussian distribution and the prior distribution P(x|z) is Gaussian, i.e., x|z ∼ N(µ(z), σ (z)) .Where µ(z) and σ (z) are two functions that are the mean and variance of the Gaussian distribution corresponding to z.Then P(x) is the cumulative of all Gaussian distributions over the integration domain.The original data x obeys a probability distribution: Solving the problem is really about µ and σ.The initial goal is to solve for P(x) and to have P(x) as large as possible, and these two functions are equivalent to solving for the maximum log likelihood about x: By means of the KL dispersion measure of the proximity of q(z|x) to P(x|z) , the above equation can be transformed into: To maximize L b and minimize KL scatter, L b is represented by the transformation as: When sampling z from a Gaussian distribution N µ k , σ 2 k , it is actually equivalent to sampling ε from N(0,1) and then calculating z = µ + ε × σ.
Traditional GAN networks have great arbitrariness in generating non-image data, and there are problems such as inaccurate data generation.For this reason, Convolutional Neural Networks (CNN) are introduced with supervised learning, drawing on DCGAN.The convolutional layer and pooling layer are formulated as: where Z i j is the i-th convolutional map in the j-th convolutional layer; Z i−1 j is the i-th convolutional map in the previous layer; w l ij is the weight of the j-th convolutional kernel of the l-convolutional layer doing the i-th operation; b i j is the bias of the j-th convolutional kernel of the l-convolutional layer.Where P l j is the j-th feature map in the l-th pooling layer; α l j is the multiplicative bias of the feature map; F d (x) is the downsampling function.Then the modified DAM structure is shown in Fig. 3.The pseudocode form of the DAM algorithm is shown in Table 1A, and "/**/" indicates the annotation.(Table 1A is presented in the Appendix, as is Table 2A below.)

Testing and analysis
The employee behavior data previously selected using AHP is used as a training dataset, and a number of features from 83 behavioral features are selected for testing and analyzed using Statistical Analysis (SA) 21 , K-Means 22 , GAN 23 , and DAM, respectively.Table 2 shows the mapping of symbolic expressions corresponding to the analysis results of the four models.

Coarse-grained accuracy analysis
Figure 4 shows the confusion matrix of the four diligence analysis methods under the 83 behavioral features, (a), (b), (c), and (d) are the results of the confusion matrices of SA, K-Means, GAN, and DAM, respectively.The data located in the dark-colored region of the main diagonal is the number of employees correctly classified, and the data located on both sides of the main diagonal is the number of employees not correctly classified.It can be seen that the confusion matrix main diagonal data of the DAM (832) is higher than the other models (GAN: 696, K-means: 570, and SA: 727), and the actual diligence analysis results are better than the other models.

Fine-grained accuracy analysis
To further compare the results, the first 42 behavioral features and 83 behavioral features were selected to be evaluated using four methods for diligence evaluation, and the advantages and disadvantages of the four methods were derived using precision (P), recall (R), and accuracy (Acc) as shown in Table 3.It can be seen that the SA of diligence analysis has a certain degree of accuracy.K-Means is less accurate among the diligence analysis, and as the features increase, the accuracy of the generated data decreases instead.This is because the K-Means is an unsupervised learning, and its classification results are not directed to "diligence".The accuracy of the GAN is slightly better than K-Means, and less accurate than SA.This is because GAN has the advantage in image generation, but its performance in data generation is not good enough, and its accuracy is low, which leads to the

Model performance and consistency test
Figure 5 shows the efficiency and Kappa coefficient of the four methods are compared.Figure 5a shows the comparison of the running time as the feature dimensions increase.It can be seen that SA takes the least time to analyze when analyzing employee diligence, DAM is second only to the SA, K-Means takes slightly more time than GAN when the feature dimension is 20, and with the increase of feature dimension, GAN takes gradually more time than K-Means.With the increase of feature dimensions, the time consuming of four types grows slightly, but the increase of feature dimensions makes the diligence analysis results also more accurate, and the Kappa coefficient also increases.As shown in Fig. 5b, the Kappa coefficient of DAM reaches 0.7384 when the feature dimension reaches 83, which is more consistent and higher than other models.Although DAM is slightly lower than the SA in terms of running time, but there is a great increase in the accuracy of the diligence analysis results, so the comprehensive consideration, DAM is more excellent in the analysis of employee diligence, and can achieve more satisfactory results.

Ethical statement
All methods were carried out in accordance with relevant guidelines and regulations.The research project has been supervised and approved by the ethics review committee of Universiti Putra Malaysia (number:  www.nature.com/scientificreports/UPM-2023012144).Informed consent was obtained from all subjects and there were no minors.Participants could not be identified in all of the data.

Abnormal behavioral detection Definition of behavioral characteristics
Employee behavior characteristics can be described in terms of roles, objects, time, and types, and information of employees is its behavioral characteristics and constitutes a behavioral feature space: The feature space corresponding to each employee constitutes a feature vector, which together form the eigenvector space S = f i |i = 1, 2, . . .n .
Role: Functions and roles are categorized into three types, managers, technicians, operators.According to the function, role characteristics respectively to establish their respective feature vector, can make the description of features more objective and accurate.Behavior_object: refers to the collection of behaviors of employees in enterprise activities, such as access control card, network browsing, professional daily office software OA system operation.Time: Behavioral time, which encompasses different scales of time ranges, or time slices of different granularity sizes.Employee behavior can be analyzed from a time perspective, and can be counted by days, weeks, months, quarters, years, and other time slices of different granularity.Days can be divided into hours, minutes, seconds and other finer-grained time slices, which can be used to analyze the real-time behavior of employees; behavioral analysis in terms of days can be used to analyze the work of employees, such as overtime, etc.; in terms of weeks can be used to analyze the daily work of employees and the work of rest days.Behavior_type: a collection of employee behavior types, indicating a collection of behavior types of employees, such as uploading, undoing, releasing, etc. in OA interactions, or receiving and sending emails.Value: Behavioral indicators, such as cumulative number of values, ratios, ratios, etc., for example, the length of time and usage rate of daily office software for managers, and the ratio of professional software to daily working time for technicians 24 .
Assuming that samples are randomly drawn from the dataset U in a releasing manner to obtain the training set T. Assuming that the number of sample draws is n, a total of n training sets, denoted as Train = {T i |i = 1, 2, . . ., n} , are generated.Each training set generates a training f i , and multiple f i are com- bined to obtain the final model F.Only 1-1/ e proportion of the samples will be added to the training set, and the remaining data is the "out-of-bag data" 25 .The objective function is: where (x n , y n ) denotes samples not involved in training and F − n (x n ) denotes sample training.Assuming that there is a feature set of Characters = {c i |i = 1, 2, . . ., m} , importance assessment is performed using RF: where E(F) denotes the error computed for out-of-bag samples and E P (F) denotes the random error superimposed on a feature for an out-of-bag sample.In this way the importance of the features is evaluated and hence the features are selected based on the importance value.
Assuming that there is a dataset U N = x i , y i |i = 1, 2, . . ., N containing N samples, each containing m features, denoted as x i = x 1 i , x 2 i , . . ., x m i , and each sample belonging to a functional role y i , the strong correlation features can be selected by ranking the feature importance properties in decreasing order.

Identification of abnormal employee behaviors
Local Outlier Factor (LOF) is a density-based sample distribution detection algorithm that determines whether a sample x is anomalous or not by comparing the density of each sample x with the density of the sample points www.nature.com/scientificreports/ in its neighboring region 26 .In detecting abnormal behaviors, the employee score f LOF (x i ) = {l 1 , l 2 , . . ., l N } is calculated.For a particular employee in different functional roles, the sample density of behavioral data is compared with the density of behavioral data of others in the same category to find out their abnormal behaviors.d x i , y i denotes the Euclidean distance between two samples x i and y i , and d i x i , y i denotes the Euclidean distance from sample x i to the k-th sample with the closest distance in its same functional role classification: N k (x i ) is the k-th neighborhood from x i , which is the set of all samples within the k-th distance from x i : The samples in the k-th neighborhood of x i satisfies |N k (x i )| ≥ k , and |N k (x i )| is the number of k nearest sam- ples.Given the parameter k, let the reachable distance reach_d k be the one that has the larger value of d x i , y i and d i (x i ): The local reachability density of x i is lrd(x i ) .Assuming that Y = y i |i = 1, 2, . . .m is a sample of the same roles in a neighborhood from x i , the average reachable distance avg(Y) of Y can be expressed as: lrd(x i ) is inversely related to avg(Y), i.e., lrd(x i ) is the inverse of avg(Y): The outlier detection value can be expressed as the ratio of the local reachable density of the data sample to the neighboring samples of the same functional role: If f LOF (x i ) is close to 1, it means that the density of x i is similar to the density of the samples in its k-distance neighborhood, and x i can be classified into the same cluster with the sample points in its k-distance neighborhood.If f LOF (x i ) is less than 1, it means that x i is a dense point.If f LOF (x i ) is much larger than 1, x i can be determined as an anomalous sample point.
The use of IF maximizes the variance, i.e., minimizes the similarity 27,28 .Given a dataset containing n samples, the degree of isolation of the delineated data points is rated by the path length of the tree.The smaller the value of the delineation path length of a data point, the larger the value of its outlier measure.IF measure whether a record x is an outlier by introducing an outlier function s(x, n): where E(h(x)) is the expected value of the path length of sample point x in a multiple tree; c(n) is the average path length of the tree given the number of samples n; and ζ is Euler's constant, which is approximately 0.5772156649.A sample is normal when s(x, n) < 0.5, and is more likely to be abnormal as s(x, n) gets closer to 1. Using this approach, s(x, n) is calculated for the employee's behavior at each point in time to obtain the point in time when the abnormal behavior occurs 29,30 .

Testing and analysis
The data used in this study comes from a new energy automobile company.The total number of employees in this company is 1200, which can be divided into three categories of managers (169, 14.08%), technicians (944, 78.67%), and operators (87, 7.25%) in terms of job classification.From the 1200 employees, 372 employees were selected according to random sampling method, of which the number of managers was 54 (14.52%); the number of technicians was 287 (77.15%); and the number of operators was 31 (8.33%).The results of the random sample generally correspond to the proportional division of the 1200 employees into the three categories of job www.nature.com/scientificreports/classification.The time frame for data collection was May 1, 2021 to December 31, 2022 a total of 609 days.Data fields include: name, IP address, behavior object, behavior time, and behavior type, etc.The data was collected using Zabbix's process monitoring method at a frequency of 5 min.If the software is used, the software monitoring data value is 1.If it is not used, the data collection value is 0. The data is cleaned and filtered to finally get the utilizable data.

Detection of abnormal employees
Abnormal behaviors is shown in Fig. 6a-c are the abnormal detection results for managers, technicians, and operators, respectively.It can be seen that under the abnormal threshold, the managers and operators have no abnormal behaviors; the abnormal group of technicians is larger, indicating that there are more abnormal behaviors among such employees.For the analysis of employees with higher abnormal values, their main abnormal behaviors occurred on usage time of system and software, indicating that the usage time and frequency of technical software are much higher than others.Combined with the results of diligence analysis, it can be interpreted that such employees have larger workload and more positive work attitude.

Mining of abnormal behavioral patterns
Intercepting the employee's behavioral data from May 1, 2021 to December 31, 2022 for a total of 609 days as the analysis data set, dividing it by hours to analyze the abnormal characteristics of temporal behavior.Within this 609-day timeframe, it is divided by days to analyze the abnormal characteristics of the abnormal employees' temporal behavioral anomalies in the unit time interval per month, and no abnormal dataset is found from the time perspective after the anomaly detection by using IF. Figure 7a and b are the results of abnormal behavior analyzed by day and by month, respectively, where the threshold values are 0.65 and 0.70.Combined with the results of experimental data, the behavioral information at different granularity times can be interpreted as follows: (1) Employees with abnormal behaviors have different data patterns embodied in different time granularity.
(2) Analyzed on a small time scale, employee behaviors usually occur in spare time, such as weekends, after work, and so on.But enlarge the time scale, in the larger time scale, abnormal employees have a certain regularity of their behavior, that is, the behavioral pattern is reflected in the coarse-grained time.
(3) The abnormal results on the fine-grained time and the non-anomalous results on the coarse-grained time line may be related to the frequency and volume of tasks that such employees are involved in.As a result, there is a high rate of overtime work during the conduct of business, especially in the technical operations.However, on a larger scale, this "abnormal behaviors" tends to become "non-abnormal behaviors", which may be related to the nature of the work of such employees, who are required to work overtime on a regular basis.

Temporal behavior prediction
Temporal feature extraction U = {u i |i = 1, 2, . . ., n} is defined as the set of employee software usage attributes 31 , where u i denotes the i-th software usage attribute: Day: the day when the behavior of software usage occurs.Begin: time to begin using the software, such as b = 8:00 indicates that an employee starts using a software at 8:00.End: time to end use of the software, such as e = 10:00 that an employee end use of a software time for 10:00.
Employee P uses the software for m times: where s j denotes the j-th software usage behavior of employee P recorded in the database.Given a sequence S = s j |j = 1, 2, . . ., m of software usage by P, predict j + 1-st usage behavior s j+1 .Conventional feature extraction is performed for time intervals in units of 1 h.Due to the large span of the time, it makes the different behavioral features in the unit time to be masked, which ultimately leads to the extracted features with large errors.For example, both 08:00 and 08:48 are located in the [8:00, 8:59], which leads to the masking of the time difference 32,33 .This paper adopts overlapping time coding to solve the problem of feature error for larger time spans.The schematic diagram of overlapping time coding is shown in Fig. 8.
Assuming that the width of the sliding window is w, and that the time series is sampled in steps of l from 00:00 onwards, with a total sampling time of 24 + w hours, 24/l discrete time intervals with overlap can be obtained, denoted as T 1 , T 2 , . . ., T 24/l .Assume that a certain moment is t and its time vector is: where e i is the i-th element of the vector E, i.e., E = {e i |i = 1, 2, . ..} , and T i is the i-th discrete time slice.After reformatting the temporal attributes of the temporal behavior using overlapping coding, it can be turned into a non-sparse vector v u i , and then feature extraction is performed on v u i to form a vector groups: v a 1 , v a 2 , . . .v a n .

Prediction of behavioral patterns
LSTM has a great advantage in time-series data prediction, in order to improve the prediction accuracy, the LSTM model based on attention mechanism (Att-LSTM) is used to predict the employee's software use behavior 34 .The correlation between the historical behavior s 1 , s 2 , . . .s m−1 and the last behavior s m is calculated using the atten- tion mechanism, and the vector − → M n of the current moment is constructed to represent the relationship between the current software usage behavior and the historical software usage behavior: where h n is the output of hidden layer at the current moment; h i is the output of hidden layer at moment i; W c denotes the linear layer; and α i is the weight, corresponding to the software usage data at moment i.Using the − → M n and h n for splicing, the result is input into the linear layer, and the output is calculated by the activation function, which results in the probabilistic output, where W o denotes the output linear layer, The Att-LSTM model construction process is as follows 35 .The pseudocode form of the Att-LSTM algorithm is shown in Table 2A, and "/**/" indicates the annotation.
Step 1: Feature extraction and dataset division.The software uses behavioral features were extracted utilizing overlapping coding approach and the dataset was divided into training and testing sets according to 8:2.
Step 2: Data elimination.The discrete temporal behavioral feature data extracted using LSTM's oblivious gate filtering is shown in the following equation.v t denotes the software-used feature vector of the input model at moment t, W denotes the weight matrix, and b denotes the bias vector.
Step 3: Data selection.The input gate of LSTM is utilized to save the processing feature data, which is stored in the neuron state as shown in the following equation, where σ is the sigmoid activation function.
where the neuron state c t can be represented as: Step 4: Output.the output gate of LSTM controls the output of the neuron: where, h t is the hidden state as shown in the following equation, where ⊗ is the element multiplication.
Step 5: Attention computation.The output vector − → M n is computed using the attention mechanism.Step 6: Prediction output.Based on the obtained self-attention matrix, the probability output o n is calculated.
Step 7: Loss value is calculated.The loss function is: where crossentropy denotes the cross entropy function and tar denotes the unique heat encoding value corresponding to the actual attribute value.

Testing and analysis
The behavior data of 372 technicians of a new energy automobile company is used to verify the prediction model, and the time period is chosen from May 1, 2021 to December 31, 2022.Based on the dataset to construct the usage behavior sequence, for each technician, a sliding window with a width of 40 is used for sampling, and the sample sequence obtained is divided into a training set and a test set according to the ratio of 8:2.The RMSE, MAE and MAPE are used to analyze the error between the prediction and the truth of the model, and the APA is used to make statistics on the error.Where Xt+1 is the prediction at the moment t + 1, X t+1 is the truth at the moment t + 1 and n is the number of samples.Further, to make the error calculation more suitable Xt+1 b , Xt+1 e , X t+1 b , and X t+1 e are utilized to represent the "Prediction of begin time", "Prediction of end time", "Truth of begin time", and "Truth of end time", respectively, is shown in Fig. 9.
The improved equation is shown below: The partial evaluation results are shown in Table 4: The APA is utilized to do statistics for the three indicators, and the results are shown in Fig. 10.Analyzing Fig. 10, it can be seen that Att-LSTM has the best prediction effect, the prediction effect of the SA is relatively poor, and the prediction effect of LSTM is better than that of the SA, but not as good as that of Att-LSTM.Att-LSTM achieved relatively ideal results in the prediction of software use behavior, but because human behavior has a great deal of ambiguity.
Behavioral variability is high in the role of technicians.Combined with the research analysis, the "abnormal" behavior of this type of roles is related to the work tasks and workload, and the uncertainty of the tasks leads to the uncertainty of the behaviors, which makes the abnormal people more abnormal when detecting the abnormalities."Abnormal" people have different detection results at different granularity timelines.In a small timeline, certain employees have abnormal behavior, such as working overtime during weekdays and weekends.However, expanding the time span and analyzing from the coarse-grained timeline, the behaviors has a certain regularity, and the detection result is "non-abnormal".This phenomenon can be explained by the fact that from the perspective of coarse-grained timeline, regular overtime work is also a regular behavior.This suggests that the work of this group is unique, and that the volume and nature of their tasks contribute to what appears to be "abnormal" work behavior.
While focusing on employee departures, it is also important to look at the flow of departures, i.e. what industries and companies they join after leaving.What are the strengths of these industries and companies that 14:11942 | https://doi.org/10.1038/s41598-024-62239-0www.nature.com/scientificreports/

Figure 7 .
Figure 7. Temporal distribution of abnormal behaviors.(a) analysis by day, (b) analysis by month.

Figure 9 .
Figure 9. Truth and prediction of software usage behaviors. history_action)

Data Acquisition and Preprocessing Development of Content and Standards Behavioral Data Preprocessing Sample Labeling Development Model Training and Optimization Diligence Analysis Behavioral Data Preprocessing Abnormality Threshold Setting Behavioral Prediction (Att-LSTM) Training Sample Development Abnormality Mining (Isolation Forest) Anomalous Behavior Analysis Temporal Behavior Prediction Behavioral Pattern Mining Random Forest Feature Selection Outlier Detection Abnormal Behavior Detection Abnormal Person Mining Behavioral Feature Extraction Cluster Analysis AHP Hierarchical Analysis Normalization GAN VAE Behavioral Pattern Mining Diligence Evaluation Preliminary Preparation Portrait Portrayal Figure 1. Process
of employee portrait portrayal.Weight calculationEmployee diligence is embodied in the behavioral data, which has a certain degree of variability, i.e., different behavioral data have different contribution values to diligence

Table 1 .
Examples of training labels (part).

Table 3 .
Data comparison of different models.

Table 4 .
Comparison of model evaluation (part).